HIPAA and AI readiness check

Has every AI company that can see patient data signed a business associate agreement with you?

Under HIPAA, any company handling patient data for you is a business associate. No signed agreement means you are not allowed to send them that data at all.

Are you sure nobody on staff is pasting patient details into a free AI account?

This is how most real leaks happen. Free accounts usually have no agreement with you, and may keep whatever gets typed in.

Do you know which other companies sit behind each AI tool you use?

Many AI products are a thin wrapper around someone else’s AI. Your patient data may travel further than the name on the invoice suggests.

Is it written in the contract that your data will not be used to train their AI?

Standard free terms often allow it. Business and healthcare plans usually do not, but only if you have it in writing.

Does each AI tool get only the patient information it actually needs?

The rule about sending only what is needed applies to AI the same as it does to a fax. Sending a whole record when a short list would do is a problem waiting to be found.

When a job does not need to know who the patient is, do you strip the name and details first?

Data with no identifying details is outside HIPAA completely. Plenty of AI jobs, like drafting and summarizing, work fine without a name or record number.

Is patient data scrambled both while moving and while stored, everywhere the AI touches it?

Encryption is what decides whether a lost record is a reportable breach or a non-event.

Do you know how long the company keeps what you send and what comes back, and can you delete it?

Recordings, transcripts and logs all count as patient data. If a company keeps them forever and you cannot delete them, that risk never goes away.

Do you know which countries your patient data is handled and stored in?

Where the data sits affects state law, insurer contracts and patient trust, even when HIPAA says nothing about it.

Does the AI tool limit staff to the patients they are already allowed to see?

An AI that can look up any record quietly undoes the access limits your record system spent years enforcing.

Do you keep a record of every AI request involving patient data: who asked, what was sent, what came back, and when?

Without this you cannot look into a problem, answer a patient asking who saw their record, or get through an audit.

Does someone lose access to the AI tools on the day they leave?

AI tools get missed on leaving checklists all the time, because they were usually brought in without IT.

Does a qualified person read and sign off everything the AI produces before it reaches a record or a patient?

AI notes, codes and instructions can read beautifully and still be wrong. Signing off is both a safety check and a record-keeping requirement.

Is it clearly stated, in the tool and in your rules, that the AI does not diagnose or give medical advice?

This is how a note-taking helper quietly turns into something making clinical decisions nobody approved.

For anything patients talk to, are emergency warning signs caught by fixed rules rather than the AI deciding?

Chest pain, stroke signs, someone talking about suicide, or bleeding in pregnancy must reach a person every single time. Not usually. Every time.

Can staff easily report when the AI gets something wrong, and does anyone read those reports?

Without this you will not find out how the tool fails until it hurts someone.

Have the people using these tools been told what they can and cannot type into them?

Almost every AI privacy slip is an ordinary person trying to get their work done faster, not someone doing harm on purpose.

Has your HIPAA risk assessment been updated to cover the AI tools you use now?

The rules require a current, accurate risk assessment. One written before you started using AI is neither.